feat(ratelimit): cap fediverse endpoints per IP; key IPv6 limiters by /64
Adds a generous per-IP baseline limiter across /ap/* reads (300/min) and a
tighter cap on the inbox POST (120/min), since each inbox delivery triggers an
outbound actor fetch. clientKey now collapses IPv6 to its /64 prefix so the
login/register/AP limiters can't be sidestepped by rotating addresses within
one allocation. Generous thresholds — real federation never trips them.
Co-Authored-By: Claude <noreply@…>